sae: fix incorrect length adjustment

PATCH Applied James Prestwood 2 participants 2 messages Oct 21, 2019

Share & tools

James Prestwood

author

2019-10-21 21:59 UTC #0 lore raw

PATCH 1/1 sae: fix incorrect length adjustment

The commit/confirm processing was incorrectly subtracting 2 from the length when they should be subtracting 6. As with the other similar change, the length is validated with mpdu_validate so subtracting 6 will not cause an overflow.

---
 src/sae.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

src/sae.c +2 -2

index 327277eb..a17c2883 100644
@@ -1037,10 +1037,10 @@ static int sae_rx_authenticate(struct auth_proto *ap,
 	switch (L_LE16_TO_CPU(auth->transaction_sequence)) {
 	case SAE_STATE_COMMITTED:
 		return sae_process_commit(sm, hdr->address_2, auth->ies,
-						len - 2);
+						len - 6);
 	case SAE_STATE_CONFIRMED:
 		return sae_process_confirm(sm, hdr->address_2, auth->ies,
-						len - 2);
+						len - 6);
 	default:
 		l_error("invalid transaction sequence %u",
 				L_LE16_TO_CPU(auth->transaction_sequence));

Signature · 1 line

2.17.1

Denis Kenzior

Applied

2019-10-21 22:12 UTC #1 lore raw

Hi James,

Quoted 7 lines · James Prestwood

The commit/confirm processing was incorrectly subtracting 2 from the length when they should be subtracting 6. As with the other similar change, the length is validated with mpdu_validate so subtracting 6 will not cause an overflow.
---
  src/sae.c | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)

Applied, thanks.

Regards,
-Denis